@ericsanchezok/meta-synergy 1.1.26 → 1.2.18

package/src/cli-backend.ts

@@ -1,12 +1,16 @@
 import { MetaSynergyControlClient } from "./control/client"
+import { MetaSynergyHolosAuth, type MetaSynergyHolosAuthSource } from "./holos/auth"
 import { MetaSynergyHolosLogin } from "./holos/login"
 import { MetaSynergyService } from "./service"
 import {
   MetaSynergyStore,
   type MetaSynergyApprovalMode,
+  type MetaSynergyAuthState,
   type MetaSynergyPendingRequest,
   type MetaSynergyState,
 } from "./state/store"
+import { MetaSynergyDisplay, type MetaSynergyHiddenReason } from "./display"
+import { MetaSynergyOwnerRegistry } from "./owner-registry"
 
 export type MetaSynergyTrustSubject = "agent" | "user"
 
@@ -30,8 +34,61 @@ export namespace MetaSynergyCLIBackend {
     return await loadSnapshot()
   }
 
-  export async function login() {
-    const result = await MetaSynergyHolosLogin.login()
+  export async function mode() {
+    if (await MetaSynergyControlClient.isAvailable()) {
+      return await MetaSynergyControlClient.request({ action: "runtime.mode" })
+    }
+    const state = await MetaSynergyStore.loadState()
+    return {
+      mode: state.runtimeMode,
+      ownership: MetaSynergyOwnerRegistry.snapshot(state.ownerRegistry),
+      connectionStatus: state.connectionStatus,
+      service: await MetaSynergyService.status(),
+    }
+  }
+
+  export async function enterManagedMode() {
+    if (await MetaSynergyControlClient.isAvailable()) {
+      return await MetaSynergyControlClient.request({ action: "runtime.enter_managed" })
+    }
+    const state = await MetaSynergyStore.loadState()
+    state.runtimeMode = "managed"
+    MetaSynergyOwnerRegistry.declareLocalOwner(state.ownerRegistry, state.envID ?? `local:${crypto.randomUUID()}`)
+    state.connectionStatus = "disconnected"
+    await MetaSynergyStore.saveState(state)
+    return {
+      mode: state.runtimeMode,
+      ownership: MetaSynergyOwnerRegistry.snapshot(state.ownerRegistry),
+      connectionStatus: state.connectionStatus,
+      service: await MetaSynergyService.status(),
+    }
+  }
+
+  export async function enterStandaloneMode() {
+    if (await MetaSynergyControlClient.isAvailable()) {
+      return await MetaSynergyControlClient.request({ action: "runtime.set_mode", mode: "standalone" })
+    }
+    const state = await MetaSynergyStore.loadState()
+    state.runtimeMode = "standalone"
+    MetaSynergyOwnerRegistry.releaseLocalOwner(state.ownerRegistry)
+    state.connectionStatus = "disconnected"
+    await MetaSynergyStore.saveState(state)
+    return {
+      mode: state.runtimeMode,
+      ownership: MetaSynergyOwnerRegistry.snapshot(state.ownerRegistry),
+      connectionStatus: state.connectionStatus,
+      service: await MetaSynergyService.status(),
+    }
+  }
+
+  export async function login(options?: { agentID?: string; agentSecret?: string }) {
+    const result =
+      options?.agentID && options?.agentSecret
+        ? await MetaSynergyHolosLogin.loginWithExistingCredentials({
+            agentID: options.agentID,
+            agentSecret: options.agentSecret,
+          })
+        : await MetaSynergyHolosLogin.login()
     return {
       agentID: result.agentID,
       service: await MetaSynergyService.status(),
@@ -48,17 +105,23 @@ export namespace MetaSynergyCLIBackend {
     state.service.pid = undefined
     state.service.stoppedAt = Date.now()
     await MetaSynergyStore.saveState(state)
-    await MetaSynergyStore.clearAuth()
+    if (state.runtimeMode !== "managed") {
+      await MetaSynergyHolosAuth.clear()
+    }
     return {
       service,
-      authCleared: true,
+      authCleared: state.runtimeMode !== "managed",
     }
   }
 
   export async function whoami() {
     const snapshot = await loadSnapshot()
+    const storedAuth = await MetaSynergyHolosAuth.inspect()
     return {
-      auth: snapshot.auth,
+      auth: sanitizeAuth(storedAuth.auth, storedAuth.source),
+      mode: snapshot.mode,
+      ownership: snapshot.ownership,
+      envID: snapshot.state.envID ?? null,
       label: snapshot.state.label ?? null,
       service: snapshot.service,
     }
@@ -76,19 +139,38 @@ export namespace MetaSynergyCLIBackend {
   }
 
   export async function doctor() {
-    const auth = await MetaSynergyStore.loadAuth()
     const state = await MetaSynergyStore.loadState()
     const service = await MetaSynergyService.status()
+    const managed = state.runtimeMode === "managed"
+    const authInfo = await MetaSynergyHolosAuth.inspect()
+    const auth = authInfo.auth
+    const ownership = MetaSynergyOwnerRegistry.snapshot(state.ownerRegistry)
     const checks = [
       {
         name: "config_dir",
         ok: true,
         detail: MetaSynergyStore.root(),
       },
+      {
+        name: "mode",
+        ok: true,
+        detail: state.runtimeMode,
+      },
+      {
+        name: "local_owner",
+        ok: ownership.local.owned,
+        detail: ownership.local.activeOwnerID ?? "No local owner declared",
+      },
       {
         name: "auth",
-        ok: Boolean(auth),
-        detail: auth ? `agent ${auth.agentID}` : "No Holos credentials found",
+        ok: managed ? true : Boolean(auth),
+        detail: managed
+          ? auth
+            ? `Stored agent ${MetaSynergyDisplay.identifier(auth.agentID, { hiddenReason: "managed" })} (${authInfo.source}) — not required in managed mode`
+            : "Managed mode does not require Holos auth"
+          : auth
+            ? `agent ${auth.agentID} (${authInfo.source})`
+            : "No Holos credentials found",
       },
       {
         name: "service",
@@ -97,12 +179,12 @@ export namespace MetaSynergyCLIBackend {
       },
       {
         name: "connection",
-        ok: state.connectionStatus === "connected",
+        ok: managed ? state.connectionStatus === "disconnected" : state.connectionStatus === "connected",
         detail: state.connectionStatus,
       },
     ]
 
-    if (auth) {
+    if (auth && !managed) {
       const verification = await MetaSynergyHolosLogin.verifySecret(auth.agentSecret)
       checks.push({
         name: "holos_secret",
@@ -115,8 +197,12 @@ export namespace MetaSynergyCLIBackend {
       ok: checks.every((check) => check.ok),
       checks,
       service,
+      mode: state.runtimeMode,
+      ownership,
       state: sanitizeState(state),
-      auth: sanitizeAuth(auth),
+      auth: sanitizeAuth(auth, authInfo.source, {
+        hiddenReason: managed ? "managed" : null,
+      }),
     }
   }
 
@@ -352,14 +438,18 @@ async function decideRequestOffline(requestID: string, status: "approved" | "den
 }
 
 async function loadSnapshot() {
-  const [auth, state, service] = await Promise.all([
-    MetaSynergyStore.loadAuth(),
+  const [state, service, authInfo] = await Promise.all([
     MetaSynergyStore.loadState(),
     MetaSynergyService.status(),
+    MetaSynergyHolosAuth.inspect(),
   ])
 
   return {
-    auth: sanitizeAuth(auth),
+    auth: sanitizeAuth(authInfo.auth, authInfo.source, {
+      hiddenReason: state.runtimeMode === "managed" ? "managed" : null,
+    }),
+    mode: state.runtimeMode,
+    ownership: MetaSynergyOwnerRegistry.snapshot(state.ownerRegistry),
     state: sanitizeState(state),
     host: {
       envID: state.envID ?? null,
@@ -370,20 +460,32 @@ async function loadSnapshot() {
   }
 }
 
-function sanitizeAuth(auth: { agentID: string; agentSecret: string } | undefined) {
+function sanitizeAuth(
+  auth: { agentID: string; agentSecret: string } | undefined,
+  source: MetaSynergyHolosAuthSource | null,
+  options?: { hiddenReason?: MetaSynergyHiddenReason | null },
+) {
   return auth
     ? {
         loggedIn: true,
-        agentID: auth.agentID,
+        agentID: MetaSynergyDisplay.identifier(auth.agentID, {
+          hiddenReason: options?.hiddenReason,
+        }),
+        source,
+        hiddenReason: options?.hiddenReason ?? null,
       }
     : {
         loggedIn: false,
         agentID: null,
+        source: null,
+        hiddenReason: null,
       }
 }
 
 function sanitizeState(state: MetaSynergyState) {
   return {
+    runtimeMode: state.runtimeMode,
+    ownerRegistry: MetaSynergyOwnerRegistry.snapshot(state.ownerRegistry),
     collaborationEnabled: state.collaborationEnabled,
     approvalMode: state.approvalMode,
     trusted: {

package/src/cli.ts

@@ -4,13 +4,25 @@ import { MetaSynergyCLIBackend, type MetaSynergyTrustSubject } from "./cli-backe
 import type { MetaSynergyApprovalMode } from "./state/store"
 import { MetaSynergyRuntime } from "./runtime"
 import { MetaSynergyService } from "./service"
+import { MetaSynergyHolosLogin } from "./holos/login"
+import { MetaSynergyDisplay } from "./display"
 
 interface CLIContext {
   json: boolean
   printLogs: boolean
-  entrypoint: string
-  argv1?: string
-  execPath: string
+  invocationEntry?: string
+  launcherPath: string
+}
+
+interface GlobalFlags {
+  help: boolean
+  json: boolean
+  printLogs: boolean
+}
+
+interface MetaSynergyLoginOptions {
+  agentID?: string
+  agentSecret?: string
 }
 
 interface CommandSuccess {
@@ -36,19 +48,18 @@ async function main() {
     renderFailure(parsed.error, {
       json: false,
       printLogs: false,
-      entrypoint: process.argv[1] ?? "./src/cli.ts",
-      argv1: process.argv[1],
-      execPath: process.execPath,
+      invocationEntry: process.argv[1],
+      launcherPath: process.execPath,
     })
+
     process.exit(parsed.error.exitCode ?? 1)
   }
 
   const context: CLIContext = {
     json: parsed.flags.json,
     printLogs: parsed.flags.printLogs,
-    entrypoint: process.argv[1] ?? "./src/cli.ts",
-    argv1: process.argv[1],
-    execPath: process.execPath,
+    invocationEntry: process.argv[1],
+    launcherPath: process.execPath,
   }
 
   if (parsed.flags.help || parsed.command.length === 0) {
@@ -102,6 +113,8 @@ async function dispatch(command: string[], context: CLIContext): Promise<Command
       return reconnect(rest)
     case "doctor":
       return doctor(rest)
+    case "mode":
+      return handleMode(rest)
     case "collaboration":
       return handleCollaboration(rest)
     case "requests":
@@ -148,8 +161,8 @@ async function startService(args: string[], context: CLIContext): Promise<Comman
     return invalidUsage("Usage: meta-synergy start")
   }
   const service = await MetaSynergyService.start({
-    execPath: context.execPath,
-    argv1: context.argv1,
+    launcherPath: context.launcherPath,
+    invocationEntry: context.invocationEntry,
     printLogs: false,
   })
   if (!service.running) {
@@ -183,8 +196,8 @@ async function restartService(args: string[], context: CLIContext): Promise<Comm
     return invalidUsage("Usage: meta-synergy restart")
   }
   const result = await MetaSynergyService.restart({
-    execPath: context.execPath,
-    argv1: context.argv1,
+    launcherPath: context.launcherPath,
+    invocationEntry: context.invocationEntry,
     printLogs: false,
   })
   if (!result.started.running) {
@@ -246,9 +259,52 @@ async function showLogs(args: string[], context: CLIContext): Promise<CommandRes
 }
 
 async function login(args: string[]): Promise<CommandResult> {
-  if (args.length > 0) {
-    return invalidUsage("Usage: meta-synergy login")
+  const parsed = parseLoginArgs(args)
+  if (!parsed.ok) {
+    return invalidUsage(parsed.usage)
+  }
+
+  if (parsed.options.agentID || parsed.options.agentSecret) {
+    if (!parsed.options.agentID || !parsed.options.agentSecret) {
+      return {
+        ok: false,
+        message: "`--agent-id` and `--agent-secret` must be provided together.",
+        usage: loginUsage(),
+      }
+    }
+
+    const result = await MetaSynergyCLIBackend.login({
+      agentID: parsed.options.agentID,
+      agentSecret: parsed.options.agentSecret,
+    })
+    return {
+      ok: true,
+      message: `Logged in as ${result.agentID}.`,
+      data: result,
+    }
   }
+
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    const mode = await MetaSynergyHolosLogin.promptLoginMode()
+    if (mode === "existing") {
+      const credentials = await MetaSynergyHolosLogin.promptForExistingCredentials()
+      if (!credentials) {
+        return {
+          ok: false,
+          message: "Login cancelled.",
+          exitCode: 1,
+        }
+      }
+
+      const result = await MetaSynergyCLIBackend.login(credentials)
+      return {
+        ok: true,
+        message: `Logged in as ${result.agentID}.`,
+        data: result,
+      }
+    }
+  }
+
   const result = await MetaSynergyCLIBackend.login()
   return {
     ok: true,
@@ -304,6 +360,37 @@ async function doctor(args: string[]): Promise<CommandResult> {
   }
 }
 
+async function handleMode(args: string[]): Promise<CommandResult> {
+  const [action, ...rest] = args
+  if (!action || action === "help") {
+    return invalidUsage("Usage: meta-synergy mode <status|managed|standalone>")
+  }
+  if (rest.length > 0) {
+    return invalidUsage("Usage: meta-synergy mode <status|managed|standalone>")
+  }
+  if (action === "status") {
+    return {
+      ok: true,
+      data: await MetaSynergyCLIBackend.mode(),
+    }
+  }
+  if (action === "managed") {
+    return {
+      ok: true,
+      message: "Managed mode enabled.",
+      data: await MetaSynergyCLIBackend.enterManagedMode(),
+    }
+  }
+  if (action === "standalone") {
+    return {
+      ok: true,
+      message: "Standalone mode enabled.",
+      data: await MetaSynergyCLIBackend.enterStandaloneMode(),
+    }
+  }
+  return invalidUsage("Usage: meta-synergy mode <status|managed|standalone>")
+}
+
 async function handleCollaboration(args: string[]): Promise<CommandResult> {
   const [action, ...rest] = args
   if (!action || action === "help") {
@@ -511,7 +598,7 @@ function parseArgv(
       continue
     }
     if (token.startsWith("-")) {
-      if (command[0] === "logs") {
+      if (command[0] === "logs" || command[0] === "login") {
         command.push(token)
         continue
       }
@@ -607,7 +694,8 @@ function rootUsage() {
     "Commands:",
     "  server [--print-logs]",
     "  start | stop | restart | status | logs",
-    "  login | logout | whoami | reconnect | doctor",
+    "  login [--agent-id ID --agent-secret SECRET] | logout | whoami | reconnect | doctor",
+    "  mode <status|managed|standalone>",
     "  collaboration <enable|disable|status>",
     "  requests <list|show|approve|deny>",
     "  session <status|kick|block>",
@@ -629,11 +717,12 @@ function usageMap(): Record<string, string> {
     restart: "Usage: meta-synergy restart",
     status: "Usage: meta-synergy status",
     logs: "Usage: meta-synergy logs [-f] [--tail N] [--since DURATION]",
-    login: "Usage: meta-synergy login",
+    login: loginUsage(),
     logout: "Usage: meta-synergy logout",
     whoami: "Usage: meta-synergy whoami",
     reconnect: "Usage: meta-synergy reconnect",
     doctor: "Usage: meta-synergy doctor",
+    mode: "Usage: meta-synergy mode <status|managed|standalone>",
     collaboration: "Usage: meta-synergy collaboration <enable|disable|status>",
     requests: "Usage: meta-synergy requests <list|show|approve|deny> [request-id]",
     session: "Usage: meta-synergy session <status|kick|block>",
@@ -722,7 +811,10 @@ function isStatusResult(value: unknown): value is {
 }
 
 function isWhoamiResult(value: unknown): value is {
-  auth: { loggedIn: boolean; agentID: string | null }
+  auth: { loggedIn: boolean; agentID: string | null; source?: string | null }
+  mode?: string
+  ownership?: { local?: { activeOwnerID?: string | null; owned?: boolean } }
+  envID?: string | null
   label: string | null
   service: { running: boolean }
 } {
@@ -782,10 +874,19 @@ function formatStatus(value: { auth: unknown; state: Record<string, unknown>; se
   const state = value.state
   const service = value.service
   const currentSession = isObject(state.currentSession) ? state.currentSession : null
+  const ownerRegistry = isObject(state.ownerRegistry) ? state.ownerRegistry : undefined
+  const localOwnership = ownerRegistry && isObject(ownerRegistry.local) ? ownerRegistry.local : undefined
+  const sessionSummary = currentSession
+    ? `${MetaSynergyDisplay.maybeIdentifier(currentSession.remoteAgentID, { unknown: "unknown" })} (${MetaSynergyDisplay.maybeIdentifier(currentSession.sessionID, { unknown: "unknown", hiddenReason: "policy" })})`
+    : "idle"
+
   return [
+    `Mode: ${typeof state.runtimeMode === "string" ? state.runtimeMode : typeof (value as { mode?: unknown }).mode === "string" ? String((value as { mode?: unknown }).mode) : "unknown"}`,
+    `Local owner: ${MetaSynergyDisplay.maybeIdentifier(localOwnership?.activeOwnerID, { hiddenReason: "policy" })}`,
     `Logged in: ${auth.loggedIn === true ? "yes" : "no"}`,
-    `Agent ID: ${typeof auth.agentID === "string" ? auth.agentID : "none"}`,
-    `Env ID: ${typeof state.envID === "string" ? state.envID : "none"}`,
+    `Agent ID: ${MetaSynergyDisplay.maybeIdentifier(auth.agentID)}`,
+    `Auth source: ${typeof auth.source === "string" ? auth.source : "none"}`,
+    `Env ID: ${MetaSynergyDisplay.maybeIdentifier(state.envID, { hiddenReason: "policy" })}`,
     `Label: ${typeof state.label === "string" ? state.label : "none"}`,
     `Service: ${service.running === true ? "running" : "stopped"}`,
     `PID: ${typeof service.pid === "number" ? String(service.pid) : "none"}`,
@@ -793,18 +894,25 @@ function formatStatus(value: { auth: unknown; state: Record<string, unknown>; se
     `Collaboration: ${state.collaborationEnabled === true ? "enabled" : "disabled"}`,
     `Approval: ${typeof state.approvalMode === "string" ? state.approvalMode : "unknown"}`,
     `Pending requests: ${Array.isArray(state.pendingRequests) ? state.pendingRequests.filter((request) => isObject(request) && request.status === "pending").length : 0}`,
-    `Session: ${currentSession ? `${String(currentSession.remoteAgentID ?? "unknown")} (${String(currentSession.sessionID ?? "unknown")})` : "idle"}`,
+    `Session: ${sessionSummary}`,
   ].join("\n")
 }
 
 function formatWhoami(value: {
-  auth: { loggedIn: boolean; agentID: string | null }
+  auth: { loggedIn: boolean; agentID: string | null; source?: string | null }
+  mode?: string
+  ownership?: { local?: { activeOwnerID?: string | null } }
+  envID?: string | null
   label: string | null
   service: { running: boolean }
 }) {
   return [
+    `Mode: ${value.mode ?? "unknown"}`,
+    `Local owner: ${MetaSynergyDisplay.maybeIdentifier(value.ownership?.local?.activeOwnerID, { hiddenReason: "policy" })}`,
     `Logged in: ${value.auth.loggedIn ? "yes" : "no"}`,
-    `Agent ID: ${value.auth.agentID ?? "none"}`,
+    `Agent ID: ${MetaSynergyDisplay.maybeIdentifier(value.auth.agentID)}`,
+    `Env ID: ${MetaSynergyDisplay.maybeIdentifier(value.envID)}`,
+    `Auth source: ${value.auth.source ?? "none"}`,
     `Label: ${value.label ?? "none"}`,
     `Service: ${value.service.running ? "running" : "stopped"}`,
   ].join("\n")
@@ -817,9 +925,9 @@ function formatRequests(requests: Array<Record<string, unknown>>) {
 
 function formatRequest(request: Record<string, unknown>) {
   return [
-    `Request ID: ${String(request.id ?? "unknown")}`,
-    `Caller: ${String(request.callerAgentID ?? "unknown")}`,
-    `Owner User: ${String(request.callerOwnerUserID ?? "unknown")}`,
+    `Request ID: ${MetaSynergyDisplay.maybeIdentifier(request.id, { unknown: "unknown", hiddenReason: "policy" })}`,
+    `Caller: ${MetaSynergyDisplay.maybeIdentifier(request.callerAgentID, { unknown: "unknown", hiddenReason: "policy" })}`,
+    `Owner User: ${request.callerOwnerUserID == null ? "none" : String(request.callerOwnerUserID)}`,
     `Label: ${typeof request.label === "string" ? request.label : "none"}`,
     `Status: ${String(request.status ?? "unknown")}`,
     `Count: ${String(request.requestCount ?? 1)}`,
@@ -828,9 +936,9 @@ function formatRequest(request: Record<string, unknown>) {
 
 function formatTrust(value: { agents: string[]; users: number[]; blockedAgents?: string[] }) {
   return [
-    `Trusted agents: ${value.agents.length > 0 ? value.agents.join(", ") : "none"}`,
+    `Trusted agents: ${MetaSynergyDisplay.identifierList(value.agents, { hiddenReason: "policy" })}`,
     `Trusted users: ${value.users.length > 0 ? value.users.join(", ") : "none"}`,
-    `Blocked agents: ${value.blockedAgents && value.blockedAgents.length > 0 ? value.blockedAgents.join(", ") : "none"}`,
+    `Blocked agents: ${MetaSynergyDisplay.identifierList(value.blockedAgents, { hiddenReason: "policy" })}`,
   ].join("\n")
 }
 
@@ -840,9 +948,9 @@ function formatSessionStatus(value: {
   service: Record<string, unknown>
 }) {
   return [
-    `Session: ${value.session ? String(value.session.sessionID ?? "unknown") : "idle"}`,
-    `Remote agent: ${value.session ? String(value.session.remoteAgentID ?? "unknown") : "none"}`,
-    `Blocked agents: ${value.blockedAgentIDs.length > 0 ? value.blockedAgentIDs.join(", ") : "none"}`,
+    `Session: ${value.session ? MetaSynergyDisplay.maybeIdentifier(value.session.sessionID, { unknown: "unknown", hiddenReason: "policy" }) : "idle"}`,
+    `Remote agent: ${value.session ? MetaSynergyDisplay.maybeIdentifier(value.session.remoteAgentID, { unknown: "unknown", hiddenReason: "policy" }) : "none"}`,
+    `Blocked agents: ${MetaSynergyDisplay.identifierList(value.blockedAgentIDs, { hiddenReason: "policy" })}`,
     `Service: ${value.service.running === true ? "running" : "stopped"}`,
   ].join("\n")
 }
@@ -857,7 +965,7 @@ function formatCollaborationStatus(value: {
     `Enabled: ${value.enabled ? "yes" : "no"}`,
     `Approval: ${value.approvalMode}`,
     `Pending requests: ${value.pendingRequestCount}`,
-    `Session: ${value.session ? String(value.session.remoteAgentID ?? value.session.sessionID ?? "busy") : "idle"}`,
+    `Session: ${value.session ? MetaSynergyDisplay.maybeIdentifier(value.session.remoteAgentID ?? value.session.sessionID, { unknown: "busy", hiddenReason: "policy" }) : "idle"}`,
   ].join("\n")
 }
 
@@ -868,6 +976,43 @@ function formatDoctor(value: { ok: boolean; checks: Array<{ name: string; ok: bo
   ].join("\n")
 }
 
+function loginUsage() {
+  return [
+    "Usage: meta-synergy login [--agent-id ID --agent-secret SECRET]",
+    "",
+    "Without flags, interactive TTY sessions let you choose browser login or importing existing credentials.",
+  ].join("\n")
+}
+
+function parseLoginArgs(args: string[]): { ok: true; options: MetaSynergyLoginOptions } | { ok: false; usage: string } {
+  const options: MetaSynergyLoginOptions = {}
+
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index]
+    if (token === "--agent-id") {
+      const next = args[index + 1]
+      if (!next || next.startsWith("-")) {
+        return { ok: false, usage: loginUsage() }
+      }
+      options.agentID = next
+      index += 1
+      continue
+    }
+    if (token === "--agent-secret") {
+      const next = args[index + 1]
+      if (!next || next.startsWith("-")) {
+        return { ok: false, usage: loginUsage() }
+      }
+      options.agentSecret = next
+      index += 1
+      continue
+    }
+    return { ok: false, usage: loginUsage() }
+  }
+
+  return { ok: true, options }
+}
+
 function parseLogsArgs(
   args: string[],
 ): { ok: true; follow: boolean; tailLines?: number; since?: string } | { ok: false; usage: string } {

package/src/control/schema.ts

@@ -23,6 +23,26 @@ export const ControlRequestSchema = z.discriminatedUnion("action", [
   z.object({ action: z.literal("service.status") }),
   z.object({ action: z.literal("service.stop") }),
   z.object({ action: z.literal("runtime.status") }),
+  z.object({ action: z.literal("runtime.mode") }),
+  z.object({ action: z.literal("runtime.enter_managed") }),
+  z.object({
+    action: z.literal("runtime.enter_managed_mode"),
+    owner: z.string().optional(),
+    ownerAgentId: z.string().optional(),
+    phase: z.number().optional(),
+  }),
+  z.object({
+    action: z.literal("runtime.set_mode"),
+    mode: z.enum(["managed", "standalone"]),
+    owner: z.string().optional(),
+    ownerAgentId: z.string().optional(),
+    leaseExpiresAt: z.number().optional(),
+  }),
+  z.object({
+    action: z.literal("runtime.release_managed"),
+    owner: z.string().optional(),
+    ownerAgentId: z.string().optional(),
+  }),
   z.object({ action: z.literal("runtime.reconnect") }),
   z.object({ action: z.literal("collaboration.status") }),
   z.object({ action: z.literal("collaboration.set"), enabled: z.boolean() }),
@@ -32,6 +52,11 @@ export const ControlRequestSchema = z.discriminatedUnion("action", [
   z.object({ action: z.literal("requests.deny"), requestID: z.string() }),
   z.object({ action: z.literal("session.status") }),
   z.object({ action: z.literal("session.kick"), block: z.boolean().optional() }),
+  z.object({
+    action: z.literal("meta.execute"),
+    caller: z.unknown(),
+    body: z.unknown(),
+  }),
   z.object({ action: z.literal("approval.get") }),
   z.object({ action: z.literal("approval.set"), mode: z.enum(["auto", "manual", "trusted-only"]) }),
   z.object({ action: z.literal("trust.list") }),